Demonstration of Shor's quantum factoring algorithm using photonic qubits 
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We report an experimental demonstration of a complied version of Shor's algorithm using four 
photonic qubits. We choose the simplest instance of this algorithm, that is, factorization of N = 15 
in the case that the period r = 2 and exploit a simplified linear optical network to coherently 
implement the quantum circuits of the modular exponential execution and semi-classical quantum 
Fourier transformation. During this computation, genuine multiparticle entanglement is observed 
which well supports its quantum nature. This experiment represents a step toward full realization 
of Shor's algorithm and scalable linear optics quantum computation. 



Shor's algorithm [l|, 0| for factoring large numbers is 
arguably the most prominent quantum algorithm to date. 
It provides a way of factorizing large integers in polyno- 
mial time using a quantum computer, a task for which 
no efficient classical method is known. Such a capacity 
would be able to break widely used cryptographic codes, 
such as the RSA public key system [3, |j| . Experimental 
realization of Shor's algorithm has been a central goal 
in quantum information science. Owing to its high ex- 
perimental demands, however, this algorithm has so far 
only been demonstrated in a nuclear magnetic resonance 
(NMR) experiment [5[ . Since the NMR experiments can- 
not prepare pure quantum states and exhibits no entan- 
glement during computation, concerns have been arisen 
on its quantum nature @. In particular, it has been 
proved that the presence of entanglement is a necessary 
condition for quantum computational speed-up over clas- 
sical computation [6(. 

The approach of using photons to implement quantum 
algorithms is appealing due to the long decoherence times 
and precise single-qubit operations 0, H, @] . Along this 
line, the Deutsch-Josza algorithm and Grover algorithm 
have been realized (see e.g. [H El E H H] ) ■ In this 
Letter, we use the photonic qubits to demonstrate the 
easiest meaningful instance of Shor's algorithm, that is, 
factorization of N = 15 in the case that the period r = 2. 
A simplified linear optics network is designed to imple- 
ment the quantum circuit. We have observed genuine 
multiparticle entanglement and multipath interference 
during computation, which thus for the first time prove 
the quantum nature of the implementation of Shor's al- 
gorithm 0. 

Suppose we wish to find a non-trivial prime factor of 
an Z-digit integer N. Even using the best known clas- 
sical algorithm, prime factorization takes exponentially 
many operations, which quickly becomes intractable as 
I increases. Shor's algorithm, in contrast, offers a new 
powerful way to solve this problem in only polynomial 
time [H, 0|- The strategy for the quantum factoring of 



a composite number N = pq, with both p and q being 
odd primes, is as follows. First we pick a random num- 
ber a (0 < a < N) with no factor in common with N. 
Then we quantum compute the period r of the modular 
exponential function (MEF): f(x) = a^modA, which is 
the smallest positive satisfying a r modN = 1. From this 
period r, at least one nontrivial factor of N is given by 
the greatest common denominator (g.c.d.) of a r / 2 ±l and 
N with probability greater than 1/2. 

Shor's algorithm provided an efficient quantum circuit 
(see Fig. la) to find the period r. Generally two registers 
of qubits are used [j], [3]; the first register with n = 
2 [~log 2 N~\ qubits and the second one with m = [log 2 N~\ 
qubits. Applying Hadamard (H) transformations on the 
first register which was initialized in the state |0)® n , it 
becomes 2~ n / 2 ^ 2 ;= g 1 \x), an equally weighted coherent 
superposition of all n-qubit computational basis. Then 
the MEF unitarily implements a^modA" on the second 
register when the first register is in state |x), giving 
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The highly entangled state Eq. |l| exhibits what Deutsch 



called "massive quantum parallelism" [la . Il6j |. as al- 
though the execution has run for only once, it entangles 
all the 2" input value x with the corresponding value of 
f(x) in parallel. Next, the quantum Fourier transforma- 
tion (QFT) is applied on the first register, yielding 
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where interference leads to peaks in the probability am- 
plitudes for terms \y) with y = c2 n /r (for integer c). 
Thus the period r can be deduced with high probability 
[H . The QFT on 2™ elements can be efficiently performed 
on a quantum computer with 0(n 2 ) gates. 
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FIG. 1: Quantum circuit for the order-finding routine of Shor's algorithm, (a). Outline of the quantum circuit, (b). Quantum 
circuit for N = 15 and a = 11. The MEF is implemented by two CNOT gates and the QFT is implemented by Hadamard 
rotations and two-qubit conditional phase gates. The gate-labeling scheme denotes the axis about which the conditional rotation 
takes place and the angle of rotation, (c). The simplified linear optics network using HWPs and PBSs to implement the MEF 
circuit and the semiclassical version of the QFT circuit. The double lines denote classical information. 



Implementations of this algorithm, even for factoriza- 
tion of a small number, place a lot of challenging exper- 
imental demands, e.g., coherent manipulations of multi- 
ple qubits and creations of highly-entangled multiqubit 
registers. Here we aim to demonstrate the simplest in- 
stance of Shor's algorithm, i.e., the factorization of 15. 
Quantum networks for evaluating the MEF have been 
designed which involve 0(n 3 ) operations T^, 17|. Since 
a x = a 2 " . . . a 2xi a X0 , the execution of MEF can be 

decomposed into a sequence of controlled multiplications. 
A general purpose algorithm to factorize 15 would require 
at least n = 8, m = 4, thus total 12 qubits [l5| . Several 
observations allow us to reduce the resources substan- 
tially for the purpose of a proof-of-principle demonstra- 
tion. First we choose to implement the algorithm with 
a = 11, this was identified in Q as the "easy" case. Since 
a 2 modl5 = 1, MEF can be simplified to multiplications 
controlled only by xo, which can be implemented by two 
controlled-NOT (CNOT) gates Ql]. A QFT then fol- 
lows to read out the period r. Such a circuit is shown in 
Fig. lb. We note there are two qubits in the second reg- 
ister which evolve trivially during computation and can 
thus be left out. 

To demonstrate the circuit of Fig. lb we use single pho- 
tons as qubits, where |0) and |1) are encoded with the 
photon's horizontal (H) and vertical (V) polarization re- 
spectively. The difficulty in implementing this circuit lies 
in the CNOT gates and conditional 7r/2-phase shift gate. 
Although such entangling gates are possible for photons 
in principle using measurement-induced nonlinearity Ml, 
currently they are still experimentally expensive [9j, 1 1 Qf | . 
Here we note that since the target qubits of the CNOT 
gates are always fixed at \H), so the gate could be re- 
alized in an easier and more efficient fashion. Such a 
CNOT gate use only a polarizing beam splitter (PBS) 
and a half- wave plate (HWP), through which an arbi- 
trary control qubit (a\H) + (5\V)) and the target qubit 
H) evolve into a\H)\H) + f3\V)\V) upon post-selection 
20l | . that is, conditioned on that there is one and only one 
photon out of each output (see Fig. lc). Furthermore, the 



QFT circuit can also be implemented with a more effi- 
cient method. It was observed by Griffiths and Niu [21 1 
that when immediately followed by measurements, the 
fully coherent QFT can be replaced by a semiclassical 
version that employs only single-qubit rotations condi- 
tioned on measurement outcomes. This eliminates the 
need for entangling gates and reduces the numbers of 
gates quadratically. Thus we finally arrive at the simpli- 
fied linear optics MEF and QFT network in Fig. lc. We 
note despite of these simplifications, our circuit suffices to 
demonstrate the underlying principles of this algorithm. 

Now we proceed with the experimental demonstration. 
Our experimental set-up is illustrated in Fig. 2, where 
a pulsed ultraviolet laser passes through two /^-barium 
borate (BBO) crystals to create two pairs of entangled 
photon [22| . We use polarizers to disentangle the photons 
and prepare them in the states \H)i with i denoting the 
spatial modes (see Fig. lc). The photons pass through 
the HWPs and are superposed on the PBSs (see Fig. 2) to 
implement the necessary single- and two-qubit gates. To 
ensure good spatial and temporal overlap, the photons 
are spectrally filtered (AAfwhw — 3.2 nm) and coupled 
by single- mode fibers [23j |. 

How could one experimentally verify a valid demon- 
stration of Shor's algorithm? First let us see the the- 
oretical predictions. After a = 11 is chosen, the 
first step of this algorithm, the MEF should evolve 
as (l/2)ELolz>|H*m°dT5) = (1/2)(|0)|1) + |1)|11) + 
|2)|1) + |3)|11)). As we rewrite it in binary representation 
(1000001) + 1011011) + 1 100001) + |111011))/2, it shows 
that a nontrivial Greenberger-Horne-Zeilinger (GHZ) [iij l 
entangled state |V>) - (1/V§)(|0) 2 |0) 3 |0) 4 + |1) 2 |1> 3 |1>4) 
is created between the two registers. For Shor's algo- 
rithm as well as some others, multiqubit entanglement is 
a necessary condition if the quantum algorithm is to offer 
an exponential speed-up over classical computation [||. 
In our experiment, as the photons pass through the MEF 
circuit, we first observe the Hong-Ou-Mandel type inter- 
ference [2^ of three photons in arms 2-3-4 (see Fig. 3b). 
Then, after fixing the delays at the zero positions, we ex- 



3 



S PBS | 


QWP 


!| Comp. \ 
ij L 


HWP 


| Polarizer 


| Filter 


UV-pulse 


BBO 


> 





± ± 




FIG. 2: Experimental set-up. Femtosecond laser pulses 
(394nm, 120fs, 76MHz) pass through two BBO crystals to 
produce two pairs of entangled photons with an average count 
of 7.8 x 10 4 s _1 . Fine adjustments of the delays between path 
2, 3, 4 are made by translation stages Ad2 and Ad4. We 
incorporate in front of each PBS a compensator (Comp.) to 
counter the additional phase shifts of the PBS. The final mea- 
surement results are then read out using polarizers and single- 
photon detectors. 



pect to determine the fidelity of the three-photon GHZ 
state and detect its genuine entanglement. The fidelity 
is judged by the overlap of the experimentally produced 
state with the ideal one: — (ip\p exp \ip). Here p can 
be decomposed as p = = (1/2) [(| HHH) {HHH\ + 

IVW) (VVV\) + {1/4)(XXX - XYY - YXY - YYX)} 
[26|] , where X and Y denote Pauli matrices a x and a y 
which correspond to measurements in basis |+/— ) = 
(1/V2)(\H) ± |V» and \R/L) = ± *|V» re- 

spectively. Figure 3c-3d shows the measurement results, 
which yield = 0.74 ± 0.02. It is proved that a fidelity 
above 50% is sufficient to show genuine entanglement of 
the GHZ states (2(| . Thus the presence of genuine entan- 
glement created between the two registers of our quan- 
tum computer is confirmed by 12 standard deviations. 

Now we move to the next step — execution of the semi- 
classical QFT, as illustrated in Fig. lc. We measure all 
possible correlations in the state of the qubit 1 and 2, 
which is the simplest way to simulate feedforward as used 
in Ref. [l3| • In the case photon 1 is measured in the 
state |1), an additional quarter wave plate is inserted in 
the arm 2 to implement the 7r/2 rotation. Each mea- 
surement is flagged by a fourfold event where all four 
detectors fire simultaneously. The experimental results 
are shown in Fig. 4. With a probability of ~ 50% the 
output is in 1 00) corresponding to a failure. Another 
~ 50% probability yields |10), which determines the pe- 
riod r = 2 2 /2 = 2, thus g.c.d.(ll 2 / 2 ± 1, 15) = 3,5, giving 
a successful factorization. To further quantitively evalu- 
ate the performance, we use the squared statistical over- 
lap 27fl of experimental data with the ideal values, which 
is defined as 7 = (T^ =0 my 2 ey^ 2 ) 2 , where m y and e y are 
the measured and expected output-state probabilities of 
the state \y), respectively. From the data in Fig. 4 we find 
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FIG. 3: Principle of three-photon interference and data of 
genuine triplet entanglement, (a) Hong-Ou-Mandel type [2^] 
interference of three photons. Three |+) polarized photons 
are directed to two PBSs from three spatial modes. As the 
PBSs transmit H and reflect V polarizations, a coincidence 
detection of three outputs can only originates from either the 
case that all photons are transmitted or all reflected, (b) 
Three-photon interference as a function of the temporal de- 
lay. Outside the coherent regime the terms \H)2\H}3\H)4, 
and | V) 2 1 V)3 1 V% are distinguishable. At the zero delay as 
an optimal superposition of \H)2\H)z\H)i and |V)2|V)3|V)4 
is achieved, thus the |+)2|+)3|+)4 events show a maximal en- 
hancement while the | — I- ) 2 1 H— ) 3 1 — } 4 events show a dip. The 
raw visibility is 0.75 ± 0.03, which after subtraction of the 
contribution of the double pair emission, can be improved 
to 0.88 ± 0.05, indicating good spatial and temporal overlap 
have been achieved. This is, to our knowledge, the first ob- 
servation of Hong-Ou-Mandel type interference which involves 
three photons from three different paths, (c) The multiphoton 
detection probabilities in the H/V measurement basis, (d) 
Measured expectation value of the observables XXX, XYY , 
YXY and YYX. The error bars denote one standard devia- 
tion, deduced from propagated Poissonian counting statistics 
of the raw detection events. 



7 = 0.99 ± 0.02, indicating a near perfect experimental 
accuracy. 

It is noticeable that the performance of the algorithm 
is considerably better than the quality of the entangle- 
ment created between the registers. The imperfections 
of our experiment mainly arise from high-order photon 
emissions and partial distinguishability of independent 
photons [28| , which cause undesired mixtures in the GHZ 
state and degrade its fidelity. However, for the execution 
of the algorithm, such mixtures happen to have the same 
effect as the desired mixtures which could have been re- 
sulted from the ideal circuit anyway (after the qubits 2,3, 
and 4 are entangled in the GHZ state, the qubit 2 is in a 
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FIG. 4: Experimental result of the output state probabili- 
ties after application of the QFT on the first register. Each 
measurement takes 120s and yields a maximum 270 fourfold 
coincidence counts for the |00) projection. 
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complete mixture tracing out of the qubit 3 and 4). 

Some further remarks are warranted here. In this ex- 
periment we have used the simplified optical two-qubit 
PBS gates which are probabilistic and upon postselec- 
tion [20(1, thus scalability is not directly implied in the 
present work. However, they can in principle be improved 
to be deterministic using the scheme by Knill et al. Q 
given more photon source and complicated linear optics 
network. Furthermore, an alternative approach, known 
as the cluster-state model [29|, [3(| provides a more effi- 
cient realization of scalable photonic quantum computa- 
tion [H, [l3, 31 1 . In this model, universal quantum com- 
putation is achieved by single-qubit measurements on a 
prepared highly entangled cluster state. 

Above we described a number of steps by which our 
MEF circuit was brought to a simpler form. While these 
steps may seem at first sight ad hoc, in fact they are an 
example of a general simplification method in the clus- 
ter state model. It has been shown that measurements 
of Pauli operator observables on cluster states transform 
the state via a set of simple (and computationally effi- 
cient) rules [3(| to a cluster state with a different graph- 
ical description. Classical pre-processing can thus pro- 
duce a cluster state implementation with a smaller num- 
ber qubits, which, as demonstrated here, can simplify the 
experimental realization. Thus, our approach can be seen 
as a hybrid of cluster-state based and circuit-based mod- 
els of quantum computation, adopting the most suitable 
model for the implementation of MEF and QFT circuits 
respectively. 

In summary, we have completed a proof-of-principle 
demonstration of a complied version of Shor's algorithm 
using photonic qubits. Genuine multiparticlc entangle- 
ment is observed during computation, which proves its 
unambiguous quantum nature. Our experiment presents 
an important step toward full realization of Shor's algo- 
rithm and scalable linear optics quantum computation. 
To factorize larger numbers in the future, significant chal- 
lenges ahead may include coherent manipulations of more 
qubits, constructions of complex multiqubit gates and 
quantum error correction [32l |. 
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